> TODAY'S SUMMARY (54 articles)
Today's cybersecurity news highlights several key threats and trends. Vanderbilt University has experienced a ransomware attack, reportedly by the BYOD group, compromising sensitive data. The Russian state-sponsored Turla group is utilizing a new malware toolset named "Cereal" to infiltrate Microsoft Exchange servers of government entities in Kazakhstan and Romania, showcasing escalating cyber-espionage tactics. Google has issued its eighth zero-day patch for Chrome this year, addressing a vulnerability actively exploited in the wild. Meanwhile, Apple and SAP have released important security updates to fix critical flaws in their software. Finally, spyware attacks are increasingly targeting a broader range of individuals, emphasizing the need for enhanced vigilance and protection measures.
|
// AI-powered summary generated at 12:00
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex EV chargers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-4156.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-4155.
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. Google is aware that exploits for both CVEs exist in the wild. For the oldstable distribution (bookworm), these problems have been fixed
This vulnerability allows remote attackers to bypass a security feature on affected installations of Microsoft Exchange. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.3. The following CVEs are assigned: CVE-2026-21527.
This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.8. The...
This episode discusses Meta Ray-Ban Smart Glasses, which blend a camera, microphone, AI features, and social media integration into sunglasses that look like normal fashion eyewear, raising major privacy concerns. It highlights reports that footage captured by the glasses may be reviewed by human co...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos Era 300. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 10.0. The following CVEs are assigned: CVE-2026-4149.
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following C...
This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. Th...
This vulnerability allows local attackers to escalate privileges on affected installations of VMware ESXi. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The follo...
Written by Katie Barnett, Director of Cyber Security at Toro Solutions
Insider risk is still often framed around intent, with the focus placed on malicious employees, disgruntled contractors, or deliberate misuse of access for personal gain.Those cases exist and they matter, but they are rarely wher...
This vulnerability allows local attackers to escalate privileges on affected installations of VMware ESXi. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The follo...
Learn how to implement cryptographic agility in MCP resource servers to protect AI infrastructure from quantum threats using PQC and modular security frameworks.
The post Cryptographic Agility in MCP Resource Server Orchestration appeared first on Security Boulevard.
In this blogpost, the newest full-time member of our research team describes his internship project.
If you would also like to try your hand at our hacking tools and techniques, don’t hesitate to check out our training offerings! Currently available: https://www.offensivecon.org/trainings/2026/explo...
Une vulnérabilité a été découverte dans OpenSSL. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
An attacker sending malformed miIO messages over WiFi to a Xiaomi Smart camera device can trigger the vulnerability described here.
This report describes a secure protocol design issue, which leads to authentication bypass in the proprietary Xiaomi miIO protocol.
The vulnerability described in this...
Une vulnérabilité a été découverte dans Google Chrome. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur. Google indique que la vulnérabilité CVE-2026-3909 est activement exploitée.
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur. Microsoft indique que la vulnérabilité CVE-2026-3910 est activement exploitée.